Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

Discovered 2026-10-12 04:39 UTC
Est. attack date 2026-10-10
Country US
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

moneygram.com Revenue $2.1 Billion MoneyGram global money transfer network moving nearly $200 billion a year through almost 500,000 retail agent locations in 200+ countries and serving 60 million+ active customers, with over 70% of transactions now digital. It earns mainly from transfer fees plus currency exchange spreads, not from owning stores, since almost all locations are partner agents like post offices and grocery chains. In 2025 it cut 449 jobs to speed up digital growth and in 2026 launched its own MGUSD dollar stablecoin and a Visa card that spends digital dollars anywhere Visa works. MoneyGram owns no factories or stores, it is a licensed money transmitter with 75+ regulatory approvals, around 2,000 employees in 36 countries, and was taken private in 2023 for $1.8 billion.

Infostealer activity detected by HudsonRock

Compromised Employees: 5

Compromised Users: 42454

Third Party Employee Credentials: 8


External Attack Surface: 107


Infostealer Distribution

Exposure Report
by ParanoidLab
198771
Passwords
445 critical
48107
Cookies
64 critical
Last queried 2026-10-12 04:39 UTC

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abusecomplaintsmarkmonitor.com
  • whoisrequestmarkmonitor.com
MX Records
  • mxa-0010c601.gslb.pphosted.com. Proofpoint
  • mxb-0010c601.gslb.pphosted.com. Proofpoint
TXT Records
  • google-site-verification=zkbjMsb5otQ7R6YKHgKMjA1c3ii3MhjJ-Ik8MfhD4KU
  • globalsign-domain-verification=87ACDA9D3A73A5CF8BFF9326DFD8D40F
  • globalsign-domain-verification=eaZZ9YxkIfj2uh62dDJCt-H84i5B4lbQDpAt7NsL3p
  • globalsign-domain-verification=NoPhQCIikmStkxsGGwIQe3uzBg4aKrg9QzXKx96smj
  • onx=1cd60065-3e6c-4d49-a604-3e3cb833b557
  • onx=afe460c8-5a3a-4b1e-9a02-ac325adb7bea
  • v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com ~all
  • infoblox-domain-mastery=d797dc770348dac92ae52ed0dce1dfdd12b9261d8db39dbed7c2c8e8f6facd1a11
  • docusign=35f554f6-5997-4c03-9d91-0613e5f279b2
  • _globalsign-domain-verification=tZwgk3p6_jv1PMP3ovzZytCrBX_Qa74FOC1CZO2i0H
  • SFMC-WOelS8qMapDLTsvkK9uHawU-64R3jN1i2HA8htoq
  • docusign=d01587ba-d6b5-47c2-ab02-17319d49e6e4
  • cloudflare_dashboard_sso=1abf66b9a297d954dbdabbe174ae501c
  • 1lUCoP-MdUzXI3iUZAkIy5Ga72RoMvMb
  • MS=ms83545586
  • jamf-site-verification=6Lj9HgACQX6NlfQSGXatTA
  • SFMC-zy4OPoZ8f6gTLZwwGhYuqw6Q3AO-kchd34mUQheU
  • SFMC-RkRYh_aAb-44vXMa54gQ89uITzomzui-oXMWX4ll
  • SFMC-9rpwKCpZCyoOc-IY3r8HjfZcLyUlGzmpoJU8ePBP
  • SFMC-xbjx9_hgkaRsy7ealSBNyMmDZYiQGxNwi8WXc98G
  • slack-domain-verification=6UlxRKKs6rKrORxQQBeeiXED6Xi4UDdYjHpdlBeg
  • v=spf2 include:spf.protection.outlook.com ~all
  • rain-domain-verification-sh08rx=HNR3YHkOWlsaGSDuxAp7PuzCb
  • SFMC-9YAXx6NMI8zIeDub-Rk9-wKmYqSQlH0Zb70mRwq9
  • globalsign-domain-verification=2F0FBAA8F9DE6965692DD9D7E32490B8
  • WbkUSZmyxm6ZknU4cL6qT5FoVdz+qjkz0QBTjv9uOTxz0YGD0/68gdT+pKpF93bXOnvTonfwb4NxwTNwrdX0zA==
  • google-site-verification=X0ygpiAM-0f4aJQHuh9aLJosTBKCSa26v6mryPt2j3s
  • 6Z65gCnWwx9KTq68Sf67
  • atlassian-domain-verification=M9j2QsGcNmnRC6sHDZD1pTSLyOLakT72QiDU/tiS2f6igmf62QB6ELmAYYT1p0cq
Cloud / SaaS Services Detected
Atlassian DocuSign Global Sign JamF Microsoft 365 Proofpoint Slack

Leak Screenshot:

Leak Screenshot